Criminals use ‘money bomb’ tactic to rob South Africans at ATMs

Criminals are dropping fake money around ATMs to confuse customers as part of a coordinated form of theft. 

Amid the confusion created by the bundle of cash, the criminals steal the money that individuals have just withdrawn from the machine.

The rise of this tactic was flagged by the South African Banking Risk Information Centre (SABRIC) in its 2025 Annual Crime Statistics Report. 

This report tracks the frequency and severity of fraud across digital banking channels and in-person theft at ATMs. 

SABRIC’s data is collected by member organisations, which include South Africa’s major banks and third parties that house ATMs, such as shopping malls. 

It uses this data to inform customers about popular fraud schemes, criminal tactics at ATMs, and to help banks improve their security. 

One of the emerging trends highlighted around ATM attacks was the so-called “money bomb” scam, which is a form of physical robbery. 

The robbery is carried out by a pair or group of highly coordinated individuals positioned around ATMs in shopping malls. 

In a choreographed sequence of events, the criminals introduce as much confusion as possible to overwhelm customers. 

The first step is to drop a fake bundle of money, called the bomb, in an area near an ATM where it is easily noticeable. 

Once the customer notices the bundle of cash, an individual or a group descends on them and typically claims ownership of it. 

In some cases, they suggest that the bundle should be shared between the customer and the accomplices. 

Rare cases include individuals posing as police officers who claim to be investigating dropped or stolen money. 

The aim of these individuals is to isolate the customer who has just withdrawn cash from an ATM and manoeuvre them into a quiet location. 

Leveraging the victim’s confusion, distraction, and isolation, the criminals then steal the real cash the customer had withdrawn. 

Old-fashioned crime on the decline

The money bomb tactic is an example of an old-fashioned style of crime that is, in most cases, falling out of favour with criminals. 

SABRIC reported that ATM attacks and bank robberies are declining in South Africa, with both falling significantly in 2025. 

While not common, these types of crime are often severe as they involve large amounts of cash and physical assault in some cases. 

They are often combined with the theft of personal belongings or bank branch assets, including computers and cellphones. 

The decline in old-fashioned robberies has been driven by banks’ investment in enhanced security measures and greater cooperation with the police. 

In the case of ATMs and branches, banks have spent billions on making them harder to access or on developing technology to destroy the value of stolen cash. 

SABRIC said that the banking industry has particularly invested in stronger roofs, ceilings, safes, and ATM rooms to prevent entry. 

This prevents criminals from gaining access through underground tunnelling, wall breaches, and cutting into safes using angle grinders. 

Another area of investment has been in after-hours intrusion detection to help police and security find the perpetrators. 

While physical theft has declined significantly, digital fraud remains elevated, and SABRIC was clear that this has little to do with banks themselves. 

SABRIC said that digital fraud does not mean that banking apps or systems have been compromised, are weak, or have been hacked by criminals. 

Rather, its data show that criminals’ main method remains deception and manipulation, with customers transferring money into criminals’ bank accounts. 

Typically, criminals impersonate trustworthy individuals to deceive customers into providing personal information or transferring money to their bank accounts. 

SABRIC said fraud almost always begins outside of the banking platform, with criminals initiating contact by impersonating trusted organisations.